Martin Prpič

A Denial of Service issue exists in the MONITOR Command Handler, allowing remote attackers to cause a system out-of-memory event.

The issue is related to Cross-Site Scripting (XSS) in key names.

The issue allows for XSS in the file attachment endpoint.

A permissions flaw was found, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.

The issue allows remote attackers to cause a denial of service, resulting in bandwidth consumption.

The issue is related to the lack of certificate verification when connecting via certain modules. Specifically, the `aliyun`, `proxmox`, and `splunk` modules do not verify certificates. This could potentially lead to security risks.

The issue allows local users to bypass authentication with X connections due to the lack of the -auth option when starting the X server.

The issue concerns the disclosure of sensitive information, specifically the ENGINE HTTPS PKI TRUST STORE PASSWORD, which is logged in the /var/log/ovirt-engine/engine.log file. This affects oVirt Engine in RHEV before version 4.0.

The issue allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name, due to improper processing of file names containing semicolons.

The issue is related to the scm plug-in in mock, which may allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file. This is due to insufficient access control, potentially enabling a remote attacker to exploit the weakness and obtain superuser privileges using a specially created file.

The issue allows local users to list running containers and possibly obtain sensitive information by running the machinectl command in oci-register-machine.

The issue allows remote attackers to cause a denial of service, resulting in memory consumption and a crash, by using a crafted tiff file.

A stack-based buffer overflow issue exists in the QXmlSimpleReader component, allowing remote attackers to cause an application crash by providing a specially crafted XML file containing multiple nested open tags.

The issue is caused by multiple stack-based buffer overflows that allow remote attackers to cause a denial-of-service. This can be achieved by writing a negative integer to the (1) cmd expand function, (2) cmd emboss function, or (3) cmd engrave function.

Name of the Vulnerable Software and Affected Versions: MCabber versions prior to 1.0.4 Description: The issue allows remote attackers to intercept communications or add themselves as an entity on a third party's roster as another user, garnering associated privileges, via crafted XMPP packets. This is achieved through roster push attacks. Recommendations: For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to roster management functions until a patch is applied. Avoid using crafted XMPP packets in the affected API endpoints until the issue is resolved.

The issue is related to a cross-site request forgery (CSRF) vulnerability in the pcsd web UI. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to.

The issue is related to a session fixation problem. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

A cross-site scripting (XSS) issue exists in the Shares overview of Openstack Manila, allowing remote authenticated users to inject arbitrary web script or HTML via the `Metadata` field in the "Create Share" form.

The issue concerns the client in MongoDB, where world-readable permissions are used on .dbshell history files. This could allow local users to obtain sensitive information by reading these files.

The issue allows local users to obtain sensitive database provisioning information. This is achieved by reading log files, specifically those generated by the ovirt-engine-provisiondb utility.